coder

mirror of https://github.com/coder/coder.git synced 2026-06-02 20:48:20 +00:00

Files

T

Cian Johnston b5a625549e feat: migrate agents-access to org-scoped system role for proper chat RBAC (#24438 )

The agents-access role previously granted chat permissions at user
scope, but chats are org-scoped objects. Rego skips user-level perms
when org_owner is set, making the grants invisible. Handler-level
band-aids used synthetic non-org-scoped objects as a workaround.

  - Migrates agents-access from users.rbac_roles (site-level) to
    organization_members.roles (org-scoped) via DB migration
  - Redefines agents-access as a predefined org-scoped builtin role
    alongside organization-admin, organization-auditor, etc., with
    Member permissions granting chat create/read/update
  - Excludes ResourceChat from OrgMemberPermissions so org membership
    alone no longer grants chat access
  - Fixes handler Authorize checks to use org-scoped objects with
semantically correct actions (ActionUpdate for message/tool operations)
  - Grants org admins the ability to assign agents-access

Closes #24250
Fixes CODAGT-174

Note: this does not update the "Usage" endpoints. Tracked by CODAGT-161.
> 🤖

2026-04-23 17:59:42 +01:00

accesscontrol.go

feat: implement deprecated flag for templates to prevent new workspaces (#10745 )

2023-11-20 19:16:18 +00:00

customroles_test.go

chore(coderd/database): remove deprecated db2sdk.List(Lazy)? methods (#21902 )

2026-02-03 17:52:07 +00:00

dbauthz_test.go

feat: migrate agents-access to org-scoped system role for proper chat RBAC (#24438 )

2026-04-23 17:59:42 +01:00

dbauthz.go

feat: migrate agents-access to org-scoped system role for proper chat RBAC (#24438 )